CVE-2025-2337
Published: 16 March 2025
Summary
CVE-2025-2337 is a low-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Matio Project Matio. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 27.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-2337 is a heap-based buffer overflow vulnerability classified as critical in tbeu/matio version 1.5.28. The issue affects the Mat_VarPrint function in the src/mat.c file, where manipulation triggers the overflow. Published on 2025-03-16, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) and maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-122 (Heap-based Buffer Overflow).
The vulnerability enables remote exploitation by unauthenticated attackers (PR:N) over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R) to trigger. Successful exploitation can lead to limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), potentially allowing partial data exposure, modification, or denial of service via the heap overflow.
Advisories and discussions are detailed in GitHub issue https://github.com/tbeu/matio/issues/267 (including comment https://github.com/tbeu/matio/issues/267#issue-2883856488) and VulDB entries at https://vuldb.com/?ctiid.299801, https://vuldb.com/?id.299801, and https://vuldb.com/?submit.510779.
The exploit has been disclosed publicly and may be used by attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6661
Vulnerability details
A vulnerability, which was classified as critical, has been found in tbeu matio 1.5.28. This issue affects the function Mat_VarPrint of the file src/mat.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has…
more
been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap-based buffer overflow in matio library's Mat_VarPrint function exploitable remotely via malicious MAT files with user interaction, enabling arbitrary code execution in client applications via Exploitation for Client Execution.
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of known vulnerabilities like this heap-based buffer overflow through patching the affected matio library.
Provides memory protections such as ASLR, DEP, and stack canaries to prevent exploitation of heap buffer overflows even if the flaw remains unpatched.
Requires validation of inputs to functions like Mat_VarPrint to restrict operations within memory bounds and block malformed data triggering the overflow.